Fraud and Prevention: Lessons from the Fire Service August 24,

Today’s Discussion By the numbers Practical next steps Lessons from the fire service 2

Today’s Discussion Lessons from the fire service Practical next steps By the numbers 3

IRS Aus. Img. Dept US Office Of Personnel Mgmt [2 nd Breach] US Office Of Personnel Mgmt Calif Dept of Child Svcs Florida Dept of Juv Justice Florida Courts Kissinger Cables Medicaid Office of The Texas Attorney General Washington Court System South African Police Greek Government Government Data Breaches Since 2012: Selected losses of 30,000+ records Source: informationisbeautiful.net. 4

“The South Carolina Department of Revenue data breach in 2012 exposed 3.6 million Social Security numbers to hackers.” -Government Technology 5

“Names, birth dates, Social Security numbers, and other personally identifiable information belonging to about 850,000 job seekers in Oregon was exposed after hackers gained illegal access to a database containing information at the State Employment Department.” -Information Week 6

“The personal data of an estimated 18 million current, former and prospective federal employees were affected by a cyber breach at the Office of Personnel Management.” -CNN 7

“Medicaid Suffers Massive $33M in Fraud in at Least 4 US States.” -Sputnik International 8

94M Government Records Since days between discovery and disclosure $201 per record breached $5.8M per breach Sources: “Rapid7 Report: Data Breaches in the Government Sector.” Rapid7. September 6, Cost of Data Breach Study, Ponemon Institute, Navigant Breach Report, March

Small & Medium Sized States… Large States… ~15M per month attacks ~10M per day attacks Source: NASCIO. Conveyed at the 2015 NASBO Annual Conference. 10

Less than half of all data breaches are due to malicious attacks 44% 31% 25% malicious attacks human error system glitches Source: 2014 Cost of Data Breach Study, Ponemon Institute, Navigant Breach Report, March

Today’s Discussion Practical next steps By the numbers Lessons from the fire service 12

every… a fire department responds to a fire one structure fire is reported one civilian fire injury is reported seconds seconds minutes Source: National Fire Protection Agency 13

1980Today Source: Michael J. Kartner. Fire Loss in the United States. 734,000 home fires 370,000 home fires 5,200 fire deaths 2,520 fire deaths 14

Q: How was the fire service able to achieve over a 50% decrease in each of these important areas? 15

AdequateFundingAdequateFundingExecutiveSupportExecutiveSupportModernTechnologyModernTechnology Visibility & Influence Influence Governance & Authority AuthorityFireProfessionalsFireProfessionals A: Through vigilant and deliberate action across the fire service. 16

AdequateFundingAdequateFundingExecutiveSupportExecutiveSupportModernTechnologyModernTechnology Visibility & Influence Influence Governance & Authority Authority Fire Security Professionals Professionals States face a lack of [sic] as it relates to cybersecurity and fraud prevention… States face a lack of [sic] as it relates to cybersecurity and fraud prevention… Source: NASCIO State CIO Survey,

Today’s Discussion By the numbers Lessons from the fire service Practical next steps 18

Have a plan – A call to action from the NGA Have a plan – A call to action from the NGA Establish a governance and authority structure Conduct risk assessments and allocate resources accordingly Implement continuous vulnerability assessments Create a culture of risk awareness 19

Stop looking in the rear view mirror. Continuous Diagnostics & Monitoring tools can help. 20

“Too little attention has been placed on continuous controls monitoring by chief financial officers, internal auditors, and corporate risk management and compliance leaders… CCM solutions can increase operational efficiency for critical financial processes, reduce fraud and improve financial governance resulting in a substantial return on investment.” “Too little attention has been placed on continuous controls monitoring by chief financial officers, internal auditors, and corporate risk management and compliance leaders… CCM solutions can increase operational efficiency for critical financial processes, reduce fraud and improve financial governance resulting in a substantial return on investment.” 21

Techniques for detecting and preventing fraud. Rules Based Analytics & Known Patterns Data Science & Predictive Analytics 22

Address the talent crisis. Hire the right professionals Collaborate with HR and define career paths Collaborate with HR and define career paths Provide training and development for professionals 23

All four layers of controls must be monitored across processes. 24

Establish a fraud prevention framework. 25

Questions? 26